Commitment and Contingencies |
3 Months Ended |
---|---|
Mar. 31, 2025 | |
Commitments and Contingencies Disclosure [Abstract] | |
Commitments and Contingencies | Commitments and Contingencies Litigation and Regulatory Matters From time to time, claims and suits arise in the ordinary course of the Company’s business. The Company has been, is currently, and may in the future be subject to claims, lawsuits, qui tam actions, civil investigative demands, subpoenas, investigations, audits and other inquiries related to its operations. In certain of these actions, plaintiffs request punitive or other damages against the Company that may not be covered by insurance. These claims, lawsuits, and proceedings are in various stages of adjudication or investigation and involve a wide variety of claims and potential outcomes. Depending on whether the underlying conduct in these or future inquiries or investigations could be considered systemic, their resolution could have a material adverse effect on the Company’s results of operations, financial position or liquidity. The Company records accruals for such contingencies to the extent that the Company concludes it is probable that a liability has been incurred and the amount of the loss can be reasonably estimated. Management does not believe that the Company is party to any proceeding that, either individually or in the aggregate could have a material adverse effect on the business, financial condition, results of operations or liquidity of the Company. In November 2023, the Company determined that a ransomware cybersecurity incident had impacted and disrupted a number of the Company’s operational and information technology systems (the “Cybersecurity Incident”). During this time, the Company’s hospitals remained operational and continued to deliver patient care utilizing established downtime procedures. The Company immediately suspended user access to impacted information technology applications, executed cybersecurity protection protocols, and took steps to restrict further unauthorized activity. Additionally, because of the time taken to contain and remediate the Cybersecurity Incident, online electronic billing systems were not functioning at their full capacities and certain billing, reimbursement and payment functions were delayed, which had an adverse impact on the Company’s results of operations and cash flows for 2023 and the first quarter of 2024. As a result of the Cybersecurity Incident, three putative class actions were filed against the Company in the U.S. District Court for the Middle District of Tennessee: Burke v. AHS Medical Holdings LLC, No. 3:23-cv-01308; Redd v. AHS Medical Holdings, LLC, No. 3:23-cv-01342; and Epperson v. AHS Management Company, Inc., No. 3:24-cv-00396. These cases were consolidated by the District Court on April 24, 2024, under the caption Hodge v. AHS Management Company, Inc., No. 3:23-cv-01308 (M.D. Tenn.). The complaint for the consolidated class action, filed on behalf of approximately 38,000 individuals who allege their personal information and protected health information were affected by the Cybersecurity Incident, generally asserts state common law claims of negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, and invasion of privacy with respect to how the Company managed sensitive data. On October 4, 2024, the Company executed a settlement agreement to resolve the consolidated class action litigation. On October 9, 2024, the District Court preliminarily approved the settlement and set the hearing for the District Court’s final approval of the settlement for August 1, 2025. Settlement of the consolidated case on the agreed terms will require the Company to make cash settlement payments that will not have a material impact on the Company’s results of operations, financial position or liquidity. The Company received $21.5 million of business insurance recovery proceeds related to the Cybersecurity Incident during the three months ended March 31, 2025, all of which was included in other non-operating gains on the Company's consolidated income statement. Acquisitions The Company has acquired, and plans to continue to acquire, businesses with prior operating histories. Acquired companies may have unknown or contingent liabilities, including liabilities for failure to comply with healthcare laws and regulations, such as billing and reimbursement, fraud and abuse and anti-kickback laws. The Company has from time to time identified certain past practices of acquired companies that do not conform to its standards. Although the Company institutes policies designed to conform such practices to its standards following completion of acquisitions, there can be no assurance that the Company will not become liable for the past activities of these acquired facilities that may later be asserted to be improper by private plaintiffs or government agencies. Although the Company generally seeks to obtain indemnification from prospective sellers covering such matters, there can be no assurance that any such matter will be covered by indemnification or, if covered, that such indemnification will be adequate to cover potential losses and fines.
|